Clarify Terraform bootstrap image tag ownership

[keithataylor]

Summary

• Add bootstrap_image_tag Terraform variable for the initial ECS task definition image tag
• Replace hardcoded :latest in Terraform task definition with var.bootstrap_image_tag
• Document the ownership split between Terraform bootstrap infrastructure and GitHub Actions SHA-based CD
• Clarify that Terraform should not roll back externally deployed ECS task definition revisions

Verified

• terraform fmt
• terraform validate
• terraform plan
• Plan reported no infrastructure changes because bootstrap_image_tag defaults to latest